Comment 21 for bug 1862760

Think the regulatory domain is not being set anywhere as /etc/default/crda has REGDOMAIN= and sudo cat /run/netplan/wpa-wlan0.conf has

ctrl_interface=/run/wpa_supplicant

network={
  ssid="SHEW-DB9990"
  key_mgmt=WPA-PSK
  psk="nope"
}

Might explain 'ieee80211 phy0: brcmf_escan_timeout: timer expired' above.

https://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/crda.git/tree/README#n8
For manual changing of regulatory domains use iw (iw reg set) or wpa_supplicant.